---
title: "Keep one audit trail for the whole · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/cloud-audit-trail
id: INF-85
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1159
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep one audit trail for the whole organization that no account can change

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-85
- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md)
- Rule: Record every management call in every account and region in one organization-wide audit trail. Store it in a separate log account under a write-once lock, and alert within 15 minutes when anyone stops or changes it.
- Check: A script confirms that the organization trail logs every region and every account, including accounts created in the last 30 days. The log account's storage reports a write-once lock with the stated period. In a sandbox, an attempt to stop the trail is refused, and the attempt itself raises an alert within 15 minutes.
- Risk: An account or system taken over
- How: After a breach, the cloud audit trail is the only record of what the attacker did with stolen keys. Attackers know this and turn it off first. Create the trail once for the whole organization, such as an AWS CloudTrail organization trail, so new accounts are covered from their first minute. On Google Cloud, Admin Activity audit logs are always on, so route them to a central bucket with a log sink. Turn on Data Access logs for buckets that hold personal data. On Azure, send the activity log of every subscription to one workspace. Turn on log file validation, so a changed file shows. Keep the store in a log archive account that production staff cannot change. Lock it as in [Keep one backup copy that no account can delete](https://agentwranglers.se/playbook/operations/disaster-recovery/immutable-backups.md). Set the period from [Keep audit logs for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention.md). Forbid stopping the trail with an organization policy, as [Block dangerous actions for the whole organization](https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_cloudtrail" "organization" {
  name                       = "organization-audit"
  s3_bucket_name             = "example-shop-log-archive"
  is_organization_trail      = true
  is_multi_region_trail      = true
  enable_log_file_validation = true
}
```

### Shell example

```sh
# Expect true and true
aws cloudtrail describe-trails --query 'trailList[?Name==`organization-audit`].[IsOrganizationTrail, IsMultiRegionTrail]' --output text
aws cloudtrail get-trail-status --name organization-audit --query IsLogging
```

## Sources

- [AWS CloudTrail, Creating a trail for an organization](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html)
- [Google Cloud Audit Logs overview](https://docs.cloud.google.com/logging/docs/audit)
- [NIST SP 800-53 Rev. 5, AU-9 Protection of Audit Information](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Related rules

- OPS-80 [Keep one backup copy that no account can delete](https://agentwranglers.se/playbook/operations/disaster-recovery/immutable-backups.md) in Operations and observability
- CMP-28 [Keep audit logs for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention.md) in Compliance and governance
- INF-40 [Block dangerous actions for the whole organization](https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/identity-and-access/cloud-audit-trail">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Turn on threat detection in every account](https://agentwranglers.se/playbook/infrastructure/identity-and-access/threat-detection.md)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md)